Cyber attacks can induce panic and extreme stress, which is the goal of attackers. After all, when you're flustered and backed into a corner, you're much more likely to make poor split-second decisions. Hackers prey on this, hoping you concede to their payout demands out of desperation.
To avoid panicking in the event of an attack, experts recommend conducting cybersecurity tabletop exercise scenarios with your key leaders.
Despite the necessity of these cyber "fire drills", many business leaders don't know where to start. To help you get started, here's an overview of what to know, who to loop in, and how to approach cybersecurity incidents with your team.
The National Institute of Standards and Technology offers a guide on incident response planning and execution, where it lists key steps as:
Preparation ensures you have all the necessary resources and contacts on hand if a cyber incident occurs. Some of these items NIST recommends having readily available include:
NIST also recommends key team members carry smartphones for flexible communication on-the-go.
Detection has a lot to do with the tools you leverage to recognize threats. Experts recommend using Zero Trust as a framework to protect your critical infrastructure. Zero Trust makes it so no user or tool is marked safe or allowed to enter the network without explicit verification from your IT team.
A key component to threat containment is called threat hunting. This is a different approach than traditional anti-virus technology that simply recognizes patterns associated with cyber attacks. Threat hunting actively looks for abnormalities to halt and eradicate them.
Technology like Endpoint Detection & Response (EDR) is a great first line of defense against attacks, including brand-new types of attacks, also referred to as zero-day attacks.
Sources that can help you detect precursors (signs that an attack could occur) and indicators (signs that an attack has occurred) include:
With your team, go over your existing tools that can detect any threats. Run through some cybersecurity tabletop exercise examples. Some scenarios could look like ransomware infections from a clicked phishing email, suspicious files found on a desktop, or endpoint data breaches.
Although you would likely call upon third-party cyber forensic specialists to work with your IT team to uncover crucial details, there are things you can do to prepare. NIST recommends keeping an inventory of necessary hardware and software including:
After you've identified the breach and conducted a thorough examination uncovering all available details, what now? The next step is to contain, remediate, and recover from the breach. This is just as crucial as becoming aware of a breach, and critical in minimizing the long-term harm to your business.
During your tabletop exercises, formulate an action plan to recover lost data, reduce or eliminate the need to pay ransomware attackers, and protect compromised individuals. To avoid the possibility of losing data completely, invest in secure data backups that are separate from your main network. This is called network segmentation.
For example, if you've determined that credit card information or social security numbers of your clients or staff have been leaked, contact a credit monitoring service to assist victims. Always have a plan to assist victims in protecting themselves from identity theft, since hackers will often leak or sell this data on the dark web.
During this phase, you will call upon your pre-determined vendors or resources to help eradicate the threat. These might include:
These professionals can help you to know what to do, how to approach any given situation, and how to recover lost data or money if possible.
Keep in mind, there's no silver bullet for resolving a cyber crisis. Often, you'll still incur significant financial and/or reputational damage regardless of the help your resources offer. To read about the real costs of a cyber attack, read our blog: What Does a Cyber Breach Cost to Fix in 2024?
After an attack, it's important to carefully document everything you uncovered. This will also help with any legal proceedings or insurance claims, so ensure you document as much as you can along the way.
By saving every piece of the story, your team can go over lessons learned to improve your security in the future. According to NIST, your documentation should include things like:
There are a few different approaches you can take to cybersecurity- proactive and reactive. Reactive cybersecurity typically happens after you've already suffered an attack, which can look like:
Although there is still a need for reactive measures after an attack, experts say it's best to reduce risk before you become a victim. Proactive cybersecurity involves implementing cybersecurity tools and best practices to stop cyber criminals in their tracks before they can cause harm. This might include:
Now that you have a framework to conduct your tabletop exercises, you can begin evaluating your current cybersecurity posture to find any gaps. By understanding your network's strengths and weaknesses, you'll have an edge to defend your livelihood from hackers who aim to threaten it.
If you're ready to dive into cybersecurity by learning where you stand, click the button below to speak to an expert about a cybersecurity audit.